From: Tobias Geerinckx-Rice via Guix-patches via <guix-patches@gnu.org>
To: 61462@debbugs.gnu.org
Subject: [bug#61462] [PATCH 01/10] system: Disallow file-like setuid-programs.
Date: Sun, 5 Feb 2023 01:00:10 +0100 [thread overview]
Message-ID: <20230205000019.6259-1-me@tobias.gr> (raw)
In-Reply-To: <87r0uuehlr.fsf@nckx>
It has been a warning for well over a year now. Now, with
privileged-programs coming, don't let's support nested deprecation
hacks.
* gnu/system.scm (<operating-system>):
Don't ‘sanitize’ the setuid-programs field.
(ensure-setuid-program-list): Delete syntax.
(%ensure-setuid-program-list): Delete variable.
---
gnu/system.scm | 28 +---------------------------
1 file changed, 1 insertion(+), 27 deletions(-)
diff --git a/gnu/system.scm b/gnu/system.scm
index df60fda53b..85380136e2 100644
--- a/gnu/system.scm
+++ b/gnu/system.scm
@@ -297,8 +297,7 @@ (define-record-type* <operating-system> operating-system
(pam-services operating-system-pam-services ; list of PAM services
(default (base-pam-services)))
(setuid-programs operating-system-setuid-programs
- (default %setuid-programs) ; list of <setuid-program>
- (sanitize ensure-setuid-program-list))
+ (default %setuid-programs)) ; list of <setuid-program>
(sudoers-file operating-system-sudoers-file ; file-like
(default %sudoers-specification))
@@ -1214,31 +1213,6 @@ (define (operating-system-environment-variables os)
;; TODO: Remove when glibc@2.23 is long gone.
("GUIX_LOCPATH" . "/run/current-system/locale")))
-;; Ensure LST is a list of <setuid-program> records and warn otherwise.
-(define-with-syntax-properties (ensure-setuid-program-list (lst properties))
- (%ensure-setuid-program-list lst properties))
-
-;; We want to be able to use defines, so define a procedure.
-(define (%ensure-setuid-program-list lst properties)
- (define warned? #f)
-
- (define (warn-once)
- (unless warned?
- (warning (source-properties->location properties)
- (G_ "representing setuid programs with file-like objects is \
-deprecated; use 'setuid-program' instead~%"))
- (set! warned? #t)))
-
- (map (match-lambda
- ((? setuid-program? program)
- program)
- (program
- ;; PROGRAM is a file-like or a gexp like #~(string-append #$foo
- ;; "/bin/bar").
- (warn-once)
- (setuid-program (program program))))
- lst))
-
(define %setuid-programs
;; Default set of setuid-root programs.
(let ((shadow (@ (gnu packages admin) shadow)))
base-commit: 2b1383c0a2f79117103b142440c64f6a751d545d
prerequisite-patch-id: 886fb4af654b597857d992a7c1e9c4bcc8bf5ab6
prerequisite-patch-id: 159d9e2558e5fb2dfc1d7442440e154dba14e500
prerequisite-patch-id: 2a1dffe5206b8a67cc544267d4ce4ddd23f3f290
prerequisite-patch-id: 992a4004d5fc0c427696da0b142942008c987083
prerequisite-patch-id: ee47c54ab1f9c72ee6974eca16aa311c80601048
prerequisite-patch-id: b50c71d9cc8fb39d18f448d9db6d61eca9f0f25b
prerequisite-patch-id: 15aab9bfe126cf392055f82d0831ad2bd8622ad4
prerequisite-patch-id: 83928f7dc391bf556c5d4405ca966c60bfdfff4b
prerequisite-patch-id: 4370270b5f1db400fe91d922da17390ef76d7962
prerequisite-patch-id: 1bf3ab2da9cb51156f6b28aac26b1c9e46f58f3c
prerequisite-patch-id: e082433b46efa579b4026c24466af3bb375c66a9
prerequisite-patch-id: 37587dd99ea94d6fd06e5a85600364a9b9e30257
prerequisite-patch-id: 48b2c23df7636eb66789649d5465c5aba5551c6d
prerequisite-patch-id: ee83168a69856ce6aacac6399af1e0f6b6126001
prerequisite-patch-id: 313f790e410773ccec61a27665d372b1f45b7236
prerequisite-patch-id: e82c8b9f3dd1b945f7cb937cf34f308b74759ca8
prerequisite-patch-id: ebd98ed22463fdb02fcfc5108a39bda89020cddd
prerequisite-patch-id: aa023f744b32055ca87a6131b0791d7524f03749
prerequisite-patch-id: 780a9840ba83b219743a5d4847dcec3e6bd4eb4c
prerequisite-patch-id: d337437b304428933fd187c3d38669f1ab6810f5
prerequisite-patch-id: 088d2163c05a955c2dc69c32cfd07a2c9bbb38fe
prerequisite-patch-id: f49f51dfc2e47144c8c9b27534f4d041d4c0abce
--
2.39.1
next prev parent reply other threads:[~2023-02-12 20:50 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-12 20:37 [bug#61462] Add support for file capabilities(7) Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` Tobias Geerinckx-Rice via Guix-patches via [this message]
2023-02-05 0:00 ` [bug#61462] [PATCH 02/10] services: setuid-program: Populate /run/privileged/bin Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 03/10] system: Use /run/privileged/bin in search paths Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 04/10] gnu: Replace (almost) all uses of /run/setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 05/10] system: Add (gnu system privilege) Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 06/10] system: (gnu system setuid) wraps " Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 07/10] build: Rename activate-setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 08/10] services: Rename setuid-program-service-type Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 09/10] system: Use privileged-program-service-type by default Tobias Geerinckx-Rice via Guix-patches via
2023-02-05 0:00 ` [bug#61462] [PATCH 10/10] system: Add privileged-programs to <operating-system> Tobias Geerinckx-Rice via Guix-patches via
2023-02-12 21:05 ` [bug#61462] Add support for file capabilities(7) Tobias Geerinckx-Rice via Guix-patches via
2023-03-04 16:55 ` Ludovic Courtès
2023-03-24 4:31 ` Vagrant Cascadian via Guix-patches
2023-04-18 13:14 ` Ludovic Courtès
2023-04-18 19:38 ` Vagrant Cascadian
2023-04-20 10:33 ` Ludovic Courtès
2023-07-15 23:59 ` [bug#61462] [PATCH v2 01/10] system: Disallow file-like setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 02/10] services: setuid-program: Populate /run/privileged/bin Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 03/10] system: Use /run/privileged/bin in search paths Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 04/10] gnu: Replace (almost) all uses of /run/setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 05/10] system: Add (gnu system privilege) Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 06/10] system: (gnu system setuid) wraps " Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 07/10] build: Rename activate-setuid-programs Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 08/10] services: Rename setuid-program-service-type Tobias Geerinckx-Rice via Guix-patches via
2023-07-15 23:59 ` [bug#61462] [PATCH v2 09/10] system: Use privileged-program-service-type by default Tobias Geerinckx-Rice via Guix-patches via
2023-07-16 0:00 ` [bug#61462] [PATCH v2 10/10] system: Add privileged-programs to <operating-system> Tobias Geerinckx-Rice via Guix-patches via
2023-07-21 18:53 ` [bug#61462] Add support for file capabilities(7) Vagrant Cascadian
2023-07-21 19:11 ` Vagrant Cascadian
2023-08-08 15:40 ` Ludovic Courtès
2023-08-29 20:29 ` [bug#61462] /run should be cleaned on boot Vagrant Cascadian
[not found] ` <87o7ipvbhh.fsf__48662.4622646318$1693341314$gmane$org@wireframe>
2023-08-29 21:21 ` bug#64775: " brian via Bug reports for GNU Guix
2023-11-15 21:37 ` [bug#61462] Add support for file capabilities(7) Vagrant Cascadian
2023-12-24 0:34 ` Vagrant Cascadian
2024-01-08 16:45 ` Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230205000019.6259-1-me@tobias.gr \
--to=guix-patches@gnu.org \
--cc=61462@debbugs.gnu.org \
--cc=me@tobias.gr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.